The WiFi certification needs and the hotel and school in the enterprise park are different, difficult to do with technology, but the user types are too many. On the same network, there are regular employees, outworkers, visitors, partners, printers, security cameras, and devices that don’t even give up passwords.
NatShell, when doing the WiFi certification program in the park, usually the first step is not to choose a model but to sort out the user type. This is not good, and everything else is for nothing.
Generally, network users in the enterprise parks can be divided into four categories: regular staff, temporary/outsourcing staff, visitors and dumb terminal equipment.
Certification programme for regular staff
Most businesses have AD domain, and the computer account used by employees at work is AD. The V7 certification system supports LDAP matching and allows WiFi to be certified directly using an AD account. There are obvious advantages: staff do not need two passwords to keep a WiFi database, IT does not need to maintain a separate WiFi database, staff leave with a no-account in AD, WiFi privileges fail to synchronize and there will be no problem that separated personnel can access the Intranet.
If an enterprise uses a company ' s micro-letter, nail or flyer, it can use these APPs as authentication portals, and the employees sweep or jump in to complete certification without additional account codes. This is more convenient than LDAPs in enterprises where staff are frequently employed and mobile, because office APs are installed on the first day of their life and do not require extra operations.
MAC Seamless Authentication is important here. After the first time an employee logs in, the system binds the MAC address of this device and then automatically removes the authentication access when he walks around the park, from the dormitory to the cafeteria and to the office, without interruption of operations, and does not re-check in every entry.
Management of temporary assistance and outsourcing
The characteristics of such personnel are: they are not in AD and have limited durations and often change people.
The more common approach is to create a separate temporary account pool in the certification system, and to generate accounts for IT or department heads after the stage, with specified validity periods (for example, three months, six months) and automatic expiry of the account number.
This would not require a single line to be moved by the administrator, which is valid for system auto-cleaning and does not leave a large number of zombie accounts.
Accreditation of visiting visitors
Some of the partners who come to the meeting, some of them providers, others customers’ tours.
The most common option is SMS-assigned Visitor VLAN. Visitors can jump on a single visitor to fill in their cell number, and receive the code and have access to the Internet but are completely isolated from the enterprise intranet.
For partners with fixed visiting hours and who need to access specific Intranet resources, the recipient department may apply for a temporary account number, which is approved at the IT back-office, and visitors enter restricted intranet areas using a temporary account number, limiting their access to resources specified when applying.
The question of the dumb terminal.
This is a blind area that many businesses can easily ignore. Printers, conference room screens, wireless cameras, door-block controllers, smart air conditioning……These devices are connected but do not fill in the account code themselves or receive SMS authentication codes.
The process is to record the MAC address in advance of the time. IT records the MAC address, marked as a non-certification device, and automatically release it on the network, but the logs are not real."- No, no."The white list is regularly checked and once a piece of equipment is scrapped or replaced, the old Mac is removed from the white list in time for it to be forged, or the MAC becomes an uncertified back door.
802.1X is another way.
If the business has high security requirements, especially for institutions such as finance, government, and research institutes, the account code plus VLAN segregation may not be sufficient, and 802.1X certifications can be considered at this time. This is based on port-level authentication, which is not available without certification, and it is a level higher than Portal-certified security.
However, 802.1X deployment is more complex: clients need to configure authentication client software and network equipment needs to support 802.1X. The threshold for IT carriers goes up. Small- and medium-sized enterprises do not usually recommend blinding 802.1X without a dedicated security team, and the pressure on them is high. Large firms with AD domain are better suited because domain controls and 802.1X can be combined, end-entry automatically completes certification, and users are barely aware of it.
Uniform certification in multi-park settings
NATSHEL_BRAND supports a unified multi-park certification structure, central accreditation management centres maintain a common user database and certification strategy, parks have access nodes, the employees’ account numbers in Beijing are directly usable at Shanghai Branch, and there is no need to reapply.
The audit logs in this setting are also centrally stored, and compliance checks do not require separate export to the campuses, all of which are viewed from the backstage.
Several places are prone to problems when they land.
First, the validity period is not set. The validity period is too short, staff members are kicked offline for hours and experience is poor; it is too long to have their account number changed into a long-term back door.
Second, VLAN planning and certification are not connected. The authentication was passed but the VLAN distribution logic was not matched, so staff members were unable to access the business system or visitors entered the intranet, which is a configuration problem that has nothing to do with the certification system itself, but it is easy to make mistakes.
Third, the dumb terminal MAC does not have a unified account. There are more equipment, no one knows what each of the MACs corresponds to on the white list, old equipment is replaced or updated, and the white list is growing longer and contains invalid records. It is recommended that IT maintain a control sheet for the equipment-MAC, linked to the purchase logs, and review it periodically.